Is my phone or laptop affected by these PHP flaws?

Simply visiting a website does not make your device a vulnerable PHP server. These flaws affect installations serving web requests. A compromised website can still be used for phishing or to deliver malicious content, so keep your browser and device updated.

I store photos and documents in the cloud. Does this mean they leaked?

No. A vulnerability is not evidence that your provider was breached. The risk depends on the software it runs, whether it patched, and how it protects your files. Check the provider’s official security notices rather than assuming every cloud service is affected.

What can I do as a website visitor?

You cannot patch a provider’s servers. Keep your own software updated, limit sensitive uploads, and check breach notices through the provider’s official website. Follow its verified instructions if your account is affected. Keep a separate backup of important files.

Does end-to-end encryption make a server breach harmless?

No. Encrypting before upload with keys kept off the server protects stored file contents, but metadata may remain exposed. A compromised web app can also deliver code that steals keys when you use it. Device security, key protection and trusted software still matter.

Why are website operators being told to patch quickly?

The flaws can allow unauthenticated remote code execution: an attacker may be able to run code without logging in. Operators should follow the latest PHP and vendor advisories. Visitors should not assume a temporary outage means data was stolen.

PHP2Shell: what the PHP flaws mean for your data

The PHP flaws: what they mean for your private data

On October 21, 2026, PHP released fixes for two critical flaws known as PHP2Shell. PHP powers many websites, and the flaws could let attackers take over affected servers. That does not mean every cloud service has been breached. Here is what the risk means for your personal files, what you can do, and where encryption helps.

By MartinOctober 22, 2026 2 min readUpdated October 24, 2026

What happened

On October 21, 2026, PHP published fixes for CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. These flaws can allow an attacker to run code on an affected web server without logging in. The official PHP advisory explains affected installations and updates. The NSA advised operators to patch promptly and consider taking affected systems offline if they could not secure them. A precautionary shutdown is not, by itself, evidence of a breach. Operators should check current vendor guidance, including later advisories, rather than rely on this article as a patch checklist.

What it means for your data

The immediate risk is to services running vulnerable PHP installations and the information those services can access. It is not evidence that all online storage is unsafe or that your files have leaked. As a visitor, you cannot patch a provider’s servers. You can limit what you upload, keep your own software updated, and check the provider’s official security notices. If your account is affected, follow its verified instructions. Avoid password-reset links in unexpected messages: go to the service directly. Keep a separate backup of files you cannot afford to lose.

Where encryption helps — and where it does not

Encrypting files on your device before upload, with keys kept off the server, helps protect their contents if stored copies are stolen. It does not make every server compromise harmless: attackers may still see metadata, delete files, or change the code a web app sends to your browser. That code could steal keys when you use the app, a risk described in Proton’s security model. Strong encryption needs secure devices and trusted software too. Files that stay only on your device are not exposed by a breach of a service they were never uploaded to.

Choose what stays on your device

You cannot prevent every software flaw, but you can choose where your private files are stored. Sealby encrypts vault contents on your device. Keep a vault local-only if you do not want its contents uploaded; encrypted iCloud sync is optional and enabled separately for each vault in Settings. If you enable sync or make an encrypted backup, copies can exist outside your device. Their protection still depends on keeping your unlock credentials and recovery phrase safe. Encryption does not protect an already-unlocked vault from someone controlling your device, or remove originals you left in other apps or cloud services.